Let\u2019s say you have an app (like Postman, a website, or another ServiceNow instance) that needs to read or write data in your ServiceNow system. <\/p>\n\n\n\n
With OAuth 2.0, the app requests a special key (called an access token) to prove it’s authorized to access certain data.<\/p>\n\n\n\n
Now, to get this Access Token and then the ServiceNow data, we need to follow the steps below:<\/strong><\/p>\n\n\n\n In this step, we set up an OAuth Application for external systems to use.<\/p>\n\n\n\n There are different OAuth 2.0 authentication flows in the ServiceNow REST API. We\u2019ll use the Authorization code grant<\/strong> flow. Redirect to ServiceNow authorization endpoint: The final authorization URL will be as follows: This will redirect the user to the ServiceNow login window. After logging in, the app asks the user to \u2018Allow access\u2019 based on the selected OAuth scopes.<\/p>\n\n\n\n After successful authorization, the browser redirects to the callback URL (redirect_uri) with a code parameter. This code is then used to request the access token.<\/p>\n\n\n Create a POST<\/strong> request to the endpoint: Below presented is a cURL example for the token request:<\/strong><\/p>\n\n\n\n The return result contains a few parameters from which we would use the following:<\/strong><\/p>\n\n\n\nStep 1: Create an OAuth Application<\/strong> in ServiceNow<\/h3>\n\n\n\n
\n
![\"servicenow-app-registries\"](\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2025\/07\/app-registries-servicenow-1200x562.webp\")
<\/figure>\n\n\n\n\n
![\"oauth-app-servicenow\"](\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2025\/07\/oauth-app-servicenow-1200x562.webp\")
<\/figure>\n\n\n\n\n
![\"testoauth-app-registries-servicenow\"](\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2025\/07\/testoauth-app-registries-servicenow-1200x562.webp\")
<\/figure>\n\n\n\n
By which you can authenticate your application and ServiceNow, click here<\/a> for more info.<\/p>\n\n\n\n
It uses a client secret as an extra authorization parameter to prevent spoofing servers.
Also, preferred for any server\/cloud application.<\/p>\n\n\n\nStep 2: Authorize using OAuth 2.0<\/strong><\/h3>\n\n\n\n
https:\/\/<InstanceName>.service-now.com\/oauth_auth.do<\/em><\/strong>
With the following <\/strong>parameters:<\/p>\n\n\n\nParameter<\/strong><\/td> Description<\/strong><\/td><\/tr> response_type<\/td> Must be code for this authentication flow.<\/td><\/tr> client_id<\/td> The Consumer Key from the connected app definition.<\/td><\/tr> redirect_uri<\/td> The Callback URL from the OAuth app definition.<\/td><\/tr> state<\/td> Used to maintain state between the request and callback.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/em>https:\/\/<InstanceName>.service-now.com\/oauth_auth.do?response_type=code&client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&state=wk_state<\/em><\/strong><\/p>\n\n\n\n![\"servicenow-rest-api-login-popup\"](\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2025\/07\/servicenow-login-popup.webp\")
<\/figure>\n<\/div>\n\n![\"servicenow-rest-api-allow-access-popup\"](\"https:\/\/cdnblog.webkul.com\/blog\/wp-content\/uploads\/2025\/07\/servicenow-allow-popup.webp\")
<\/figure>\n<\/div>\n\n\nStep 3: Get Access Token<\/strong><\/h3>\n\n\n\n
https:\/\/<InstanceName>.service-now.com\/oauth_token.do<\/em><\/strong>
With the following parameters:<\/p>\n\n\n\nParameter<\/strong><\/td> Description<\/strong><\/td><\/tr> grant_type<\/td> The value must be authorization_code for this flow.<\/td><\/tr> client_id<\/td> The Client ID from the OAuth app definition.<\/td><\/tr> client_secret<\/td> The Client Secret from the OAuth app definition. Required for the Authorization code grant flow<\/td><\/tr> redirect_uri<\/td> The Callback URL from the OAuth app definition.<\/td><\/tr> code<\/td> The authorization code that the consumer must use to obtain the access and refresh tokens.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \/** Code for retrieving ServiceNow access token via cURL.\n*\n* @category ServiceNow\n* @author Webkul Software Pvt Ltd <support@webkul.com>;\n* @copyright 2025 webkul.com. All Rights Reserved.\n* @license GNU General Public License version 2 or later; see LICENSE.txt\n* @link http:\/\/webkul.uvdesk.com\n*\/\n\n\/\/ POST body\n$postFields = http_build_query([\n 'grant_type' => 'authorization_code',\n 'client_id' => CLIENT_ID,\n 'client_secret' => CLIENT_SECRET,\n 'redirect_uri' => REDIRECT_URI,\n 'code' => $code,\n]);\n\n\/\/ Initialize cURL\n$ch = curl_init('https:\/\/'.SN_INSTANCE.'.service-now.com\/oauth_token.do');\ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\ncurl_setopt($ch, CURLOPT_POST, true);\ncurl_setopt($ch, CURLOPT_POSTFIELDS, $postFields);\ncurl_setopt($ch, CURLOPT_HTTPHEADER, [\n 'Content-Type: application\/x-www-form-urlencoded'\n]);\n\n$response = curl_exec($ch);\n$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\n$error = curl_error($ch);\ncurl_close($ch);<\/pre>\n\n\n\n